All Questions

0
votes
1answer
73 views

why code at .rodata executes [closed]

How come the following code executes if buf* is @ rodata segment ? #include <stdio.h> char *buf[] = { "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\ \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\...
3
votes
1answer
84 views

Why disassemble multi-thread binary is hard?

Why disassemble multi-thread binary is hard? I also know that some obfuscation techniques are to create unnecessary threads. But why reverse engineering multi-thread program is hard.
2
votes
1answer
48 views

There is something else than a “DllMain” in a module for its initialization?

All right, Actually I am manually mapping a module into a process, actually my mapper calls DllEntryPoint from standard struct IMAGE_NT_HEADERS thus IMAGE_NT_HEADERS::OptionalHeader::...
1
vote
1answer
44 views

Unknown parameters in custom signal handler on Linux

0x0000000008001946: mov 0xa8(%rdx),%rax 0x000000000800194d: lea 0x28(%rdx),%rsi 0x0000000008001951: lea 0x2(%rax),%rdi 0x0000000008001955: add $0xe,%rax 0x0000000008001959: ...
1
vote
1answer
102 views

How does ASLR in Windows work?

I had recently this situation where in a program I was debugging I found: 03CD38D4: 8B15 8C5FF703 MOV EDX, DWORD PTR DS:[3F75F8C] If I look for these bytes in the physical file I found nothing. I ...
1
vote
0answers
37 views

How can a segfault happen during the libc exit call on Linux?

I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge. While testing, I have noticed ...
0
votes
1answer
35 views

Remote debugger for Linux from one VM (IDA) to another (running the debuggee)

I want to debug a Linux program (ELF), but my IDA Pro is on a Windows 10 VM and I want to use remote debugging to debug the program on Ubuntu (also in a VM). So, is it possible to debug if both ...
0
votes
1answer
56 views

What is a good resource to learn about how the call stack works while programming in C?

Sorry if this is a duplicate and please point me in the right direction if so. I have a strong foundation in C programming and I know how memory is allocated on the stack for variables/arrays/...
0
votes
2answers
137 views

Extracting the contents of an unknown archive file format

I need some help and advice here. I am privately learning on how to reverse engineer our teachers custom file archive file that have other files stored inside of them. for school project. But, I am ...
0
votes
1answer
40 views

how to use core file in radare2?

In gdb i can backtrace with core file and executable file. It seems radare2 can read core file. like this $ r2 core Setting up coredump: asm.arch <-> x86 and asm.bits <-> 64 Setting up ...
2
votes
1answer
72 views

Why stack canary can be brute-force one byte at a time?

I am reading brute-forcing stack canary. But I am confused why the server can be brute-forced one byte at a time on a crashable-server and what does mean this fork-and-accept ?
0
votes
1answer
37 views

Finding “controller vibration” function in game

I want to build a "force feedback chair" for Need for Speed: Payback, so I thought about hooking the function responsible for the controller vibration and sending the motor speed parameter to a motor ...
2
votes
1answer
45 views

radare2 how to interpret ascii-art color bars?

I can't understand the meaning of ascii-art color bars. what is the meaning of the # charaters? [0x08000210]> iS= 00 0x08000000 |---------------------------------| 0x08000000 0 --- 01 ...
0
votes
1answer
42 views

Calculate LEA operand

I have those opcodes on 64 bits: 48 8D 35 45 CE FF FF >>> lea rsi, [rip - 0x31bb]. How can I get the 0x31bb value from those opcodes and how can I know if I have a + sign or a - sign ...
1
vote
0answers
66 views

How to decompile a obfuscated mach-o dylib?

I am trying to decompile a dylib called libConfigurer64.dylib, which is loaded from the environment variable "DYLD_INSERT_LIBRARIES" I want to analyze what it really does, so I dragged it in to IDA,...
0
votes
1answer
51 views

Android application can't open pasted SQLite database

So I have an installed application on my Android phone and it stores some data in an password protected SQLite database in the /data/data//databases/ folder. I used adb shell to move the database to ...
1
vote
2answers
78 views

How to identify if buffer allocate on stack or heap?

When I looking on Ida with static analyze I see that buffer pass to function/ function fill data in buffer. How can I know if this buffer allocate in stack/ heap?
1
vote
1answer
27 views

WebSocket debugging in Javascript app gives “401 Unauthorized” [closed]

I'm attempting to reverse engineer a private API used by an Android app that makes use of WebSockets. These requests are made from JavaScript inside a WebView. I use Charles to intercept both HTTP ...
2
votes
0answers
134 views

Unable to figure out how to map segments in IDA

I have a 2 MB executable that I'm attempting to reverse engineer. It's executed on a 16-bit 8086 CPU. The segments go from 4000 (0x140000) to F000 (0x1F0000). I'm attempting to map the segments in ...
0
votes
1answer
47 views

x64dbg - Conditional breakpoint based on function argument

How can I set a conditional breakpoint based on the argument of a function? I am trying to break on the windows function LoadLibraryExW: https://docs.microsoft.com/en-us/windows/desktop/api/...
1
vote
0answers
52 views

Help understanding ARM Assembly example code - loops, set flags and code mnemonics

This is the example code: _start: LDR r0, =n LDR r0, [r0] LDR r1, =array1 MOV r2, #0 LDR r4, =array2 loop: LDR r3, [r1], #4 CMP r3, #58 BGT a_point CMP r3, #47 BLT a_point SUB r3, r3, #0x30 STR r3, [...
0
votes
1answer
54 views

How to see address in Graph view Ida

In Ida when I want to see the address of code I must switch to Text view How can I see the address of code with Graph view ? By the way, is there grapgh viwe in OllyDbg?
2
votes
3answers
236 views

Academic journals for latest RE/Malware/Exploitation research?

I am looking for journals to keep track of the latest advances in reverse engineering, binary analysis, malware, binary exploitation, etc.
1
vote
0answers
48 views

Looking for crackme with full solutions [duplicate]

There are lot of crack me site. I looking for site that have lot of hard crack me/ malware to research anti debug/anti vm... but with full solution
0
votes
1answer
62 views

The callstack does not show the message handler

After clicking a button or doing anything which might generate a message to be translated and dispatched, why is that the callstack might not show the message handler? Say I am reversing an ...
0
votes
1answer
85 views

How do I go about overriding a function internally defined in a binary on Linux?

To be specific, I cannot recompile this binary, nor do I have access to the sourcecode. The functions are not defined within a shared library. So, how can I go about changing a function, or ...
0
votes
1answer
66 views

Is it possible to add a label to an ELF executable and then call that label? If so, how?

Let's say we have this simple "hello world" nasm code that will be compiled to an ELF executable: global main section .data message db "Hello World!", 0x00 section .text main: call ...
0
votes
1answer
134 views

How int3 looks like in C

This is assembly code that can catch debugger with int 3 : MOV ECX, ExceptionHandler MOV DWORD PTR FS:[0], ExceptionHandler INT3 ///there is debugger!!! ExceptionHandler: ////no ...
0
votes
1answer
74 views

Radare2 Disassembler How Do You Organize Visual Panels (V!)?

I would like to use Radare2 to learn about how C is assembled into assembly but I am having trouble with the layout. I think the V! mode would be very handy as you can watch the registers update as ...
1
vote
1answer
59 views

Is there any debugger that supports step-back? [duplicate]

In Ida when I use debugger, but I can't step back. Is there any debugger that allow go backwards?
2
votes
1answer
85 views

Help to identify unknown IC from Microchip

I am asking here hoping that someone may have experience identifying these kind of old chips. Googling the reference just shows some forums with people in same situation as me. IC reference: 25072478 ...
0
votes
1answer
45 views

x64dbg “System” meaning

I'm a bit confused about what "system" refers to when looking at the callstack in x64dbg. Does it mean the code is currently being executed in ring0? I thought that only system calls are executed in ...
1
vote
1answer
58 views

Debugger Win32 Local vs WinDbg in Ida vs Ollydbg

When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages. I know that Ida designated for static analyze , but there are some debugger in ...
0
votes
1answer
48 views

Start Symbolic Analysis at a Given Address with Angr

Lets suppose I have a very big binary and I want to reverse just a part of this binary. Is there a way to tell angr to start symbolic analysis at a given address ?
4
votes
1answer
62 views

Z80 Absolute Jump to offset in middle of instruction

I'm working on reverse engineering an embedded system which uses a Z80 processor. I'm using IDA as the disassembler. I ran upon an absolute jump (JP) that seems to jump to the middle of another ...
-1
votes
1answer
76 views

Understanding assembly code: “mov dword” and “mov qword” in main.c

I have just converted this piece of code in assembly: #include <stdio.h> #include <stdlib.h> int main(int argc, char** argv) { return (1); } Here are my questions: Once you push ...
1
vote
1answer
41 views

Flash ROM has lower max voltage than read device?

I'm planning to read a MX25U1635E chip using the CH341a reader. The specs for that chip say it has a max voltage of 1.6-2.0 volts. The reader has an output of 3.3-5.0 volts. Most tutorials for the ...
1
vote
1answer
60 views

Function names syntax returned by radare2's afl?

Radare2's afl command returns function names with a specific syntax that I could not find documentation on: For example: radare2 -2 -A -q -c "aflj" C:/Windows/system32/advapi32.dll 0x77cce13c 22 ...
0
votes
2answers
110 views

Understanding Hex-Rays pseudo code

What is the meaning of the following pseudo-code?: BYTE1(v2) or BYTE1(v2) HIBYTE(v2) Is there any explanation for those macros? How can I implement those macros in C code?
2
votes
1answer
51 views

angr with a golang target

Here is a very basic golang program: package main import "fmt" func main() { var s1 string fmt.Scanln(&s1) if s1=="goodpassword" { fmt.Println("Good") } else { ...
-1
votes
1answer
110 views

how should i change an instruction to NOP in IDA?

I am new with IDA assembler and i used to work with hopper app. the problem is i can't change instruction in IDA from something like CBNZ to NOP. is there any button to do this? i can't find anything ...
0
votes
1answer
59 views

Print string at address with radare2

I have created a very basic golang program which display a message with fmt.Println(). Here is what is see in radare2: lea rcx, obj.main.statictmp_0 ; 0x4c84b0 ; "y[K" mov qword [local_48h], rcx lea ...
2
votes
1answer
76 views

How do the PSHUFLW and PSHUFD instructions work?

I have been trying to figure out exactly what is happening with these instructions and can't make sense of them. I can see that the PSHUFLW instruction acts upon the first 16 bytes of the XMM register ...
0
votes
2answers
45 views

How does this command modify the condition?

I'm new to radare2 here. Just started learning and I was trying out a challenge. What does the 3 columns in the radare2 visual mode represent? May I know how the command below: wa je 0x400976 @...
1
vote
0answers
17 views

USB 3G Stick changing frequency bands [closed]

I have 4 different types of USB 3G modems from Europe. They're not operator locked. I'm trying to use them on an American network for 3G connectivity. Even though they state "850, 900, 1800, 1900 MHz"...
1
vote
1answer
33 views

How is the I/O address space on the PC arranged?

I'm disassembling a 16-bit DOS executable, and looking at the following three instructions: mov dx,0x3ce mov ax,0xff08 out dx,ax I know it writes the value 0xff08 to I/O port 0x3ce. I also know that ...
2
votes
1answer
79 views

ROP chain: Buffer Overflow Return Pointer

I am trying to get a ROP exploit to work on Ubuntu 18.04 LTS 64bit. I have a 64 bit binary (Nx enabled, ASLR disabled) with vuln function as follows: public vuln vuln proc near var_100= byte ptr -...
3
votes
1answer
91 views

Certain bytes in the memory (RAM) get changed after the program starts. Why?

I'm in a situation where I have an executable file. When I start it within the debugger (x32dbg), with breakpoints set to every occasion (DLL entry, DLL load, Thread start,..), to restrict the amount ...
1
vote
0answers
24 views

Motorola Freescale mpc564 microcontroller

Im hoping somebody here can give me some advice. Im trying to read the flash contents of a Mpc564 Motorola MCU. The flash size is 512KB The processor was removed from a bad circuit board. Is there ...
0
votes
1answer
132 views

How to export function from exe file?

I open exe file (running on Windows) in Ida , and saw a function (for example sub_ABC) that I want to export , so I can call this function from c# code. How can I export function that I Know the name ...

15 30 50 per page